Cl0p Ransomware Actively Exploiting Oracle E-Business Suite 0-Day Vulnerability in the Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Oracle has issued an emergency security alert for a critical zero-day vulnerability (CVE-2025-61882)<\/a> in its E-Business Suite after the notorious Cl0p ransomware group began extorting customers who failed to patch their systems.\u00a0<\/p>\n The vulnerability, carrying a maximum CVSS score of 9.8, affects the Business Intelligence Publisher (BI Publisher) Integration component and enables remote code execution without authentication.<\/p>\n The vulnerability CVE-2025-61882 represents a significant threat to Oracle E-Business Suite<\/a> deployments worldwide. Security researchers have confirmed that public proof-of-concept exploits are now available, dramatically increasing the risk for unpatched systems.\u00a0<\/p>\n The flaw affects Oracle EBS versions 12.2.3 through 12.2.14, requiring organizations to implement Oracle\u2019s October 2023 CPU as a prerequisite before applying the latest security patches.<\/p>\n Tenable investigation revealed that Cl0p ransomware<\/a> operators have been systematically targeting Oracle E-Business Suite installations, leveraging this zero-day vulnerability to gain unauthorized access to enterprise systems.\u00a0<\/p>\n The attack campaign came to light when multiple Oracle customers received extortion emails from the Cl0p group, claiming to have successfully infiltrated their EBS environments and stolen sensitive business data.<\/p>\n Tenable stated that<\/a> the Oracle Concurrent Processing component vulnerability allows attackers to execute arbitrary code remotely without requiring authentication credentials, making it an attractive target for cybercriminals.\u00a0<\/p>\n Security experts emphasize that the combination of widespread Oracle EBS deployment in enterprise environments and the vulnerability\u2019s high severity score creates a perfect storm for large-scale attacks.<\/p>\n The Cl0p ransomware group, also known as TA505 and FIN11, has established a pattern of targeting zero-day vulnerabilities in enterprise file transfer and business application software.\u00a0<\/p>\n Previous campaigns successfully exploited vulnerabilities in Accellion, MOVEit <\/a>Transfer<\/a>, GoAnywhere, and Cleo platforms, demonstrating the group\u2019s sophisticated capability to identify and weaponize high-impact security flaws.<\/p>\nCl0p Exploiting Unpatched Oracle EBS Vulnerability<\/strong><\/h2>\n